Penetration Testing 101: What to Expect and How to Prepare
Considering your first penetration test? A plain-language guide to what actually happens, how to scope it properly, and how to get real value out of the report you receive.
Commissioning your first penetration test can feel like handing a stranger the keys to your systems and hoping for the best. Knowing what actually happens, and what a good test looks like compared with a rushed, low-value one, makes the process far less intimidating and far more useful.
What a penetration test actually is
A penetration test is an authorized, deliberate attempt to find and exploit↗ security weaknesses in a system, application, or network. The tester acts like a real attacker but works under a legal agreement, a defined scope, and a duty to report findings rather than exploit them for gain. It differs from an automated vulnerability↗ scan, which finds known issues but does not try to chain them together the way a real attacker would.
Types of penetration tests
| Type | Question it answers |
|---|---|
| External network | What can an attacker reach and exploit from the open internet with no prior access? |
| Internal network | What could an attacker, or a compromised employee account, do once inside the network? |
| Web and mobile application | Which logic flaws, authentication↗ bypasses, and injection vulnerabilities exist in your actual software? |
| Social engineering↗ | How well does the human layer hold up against phishing↗ simulations and physical security tests? |
Preparing to commission a test
- Define scope precisely. Which systems, applications, or network ranges are in scope, and which are explicitly out of bounds? Ambiguous scope is the most common source of disputes after a test.
- Set the rules of engagement. Can the tester exploit what they find or only identify it? Is denial-of-service testing permitted? Who is the emergency contact if something goes wrong?
- Choose a methodology and standard. Reputable testers work against recognized methodologies, which gives you a way to judge thoroughness rather than relying on trust alone. NIST's Technical Guide to Information Security↗ Testing and Assessment (SP 800-115) is one reference; it organizes testing into planning, execution, and post-testing phases.
- Verify tester credentials and insurance. Recognized industry certifications and professional indemnity insurance are a baseline, given the access you are granting.
What happens during the test
Most tests follow a similar arc: reconnaissance and information gathering, vulnerability identification, exploitation attempts against confirmed vulnerabilities within the agreed rules, and privilege escalation↗ or lateral movement↗ to demonstrate real business impact. The point is to show not just "this door is unlocked" but "and here is what someone could do once inside."
Getting real value from the report
A good report does more than list vulnerabilities by severity. Look for these three things:
| Look for | Why |
|---|---|
| Clear reproduction steps | Your team can verify each finding and later confirm the fix |
| Business-impact framing | It explains why a specific technical flaw matters to your organization |
| Prioritized remediation guidance | Advice that accounts for your environment, not generic text copied across every client |
The most common mistake: treating the test as the finish line
A penetration test is a snapshot of a moving target. The real value comes afterward: remediating findings on a tracked timeline, re-testing to confirm the fixes worked, and treating findings that recur across tests as a sign that a process, not just one system, needs to change.
Related reading
